The security community is on high alert as a backdoor implant targeting Cisco devices has been discovered. Utilizing zero-day vulnerabilities in IOS XE software, threat actors have recently modified the implant to evade detection, posing a significant risk to thousands of affected devices.
Evading detection
In an attempt to prolong the lifespan of their malicious activities, the threat actors behind the backdoor implant have made crucial modifications. The implant will now only respond if the correct Authorization HTTP header is set, making it considerably more challenging to detect. This development has added an extra layer of complexity for security experts who are striving to identify and mitigate the risks associated with compromised Cisco devices.
Exploiting vulnerabilities
To gain unauthorized access to targeted devices, the attackers leverage two specific vulnerabilities: CVE-2023-20198 and CVE-2023-20273. These vulnerabilities allow the threat actors to exploit weaknesses in the system, enabling them to create a privileged account and discreetly deploy a Lua-based implant. This implant acts as a backdoor, granting unauthorized access and control over the compromised devices.
Cisco’s response
Recognizing the seriousness of the situation, Cisco has taken swift action to address the backdoor implant issue. The company has started rolling out security updates to patch the exploited vulnerabilities and mitigate the potential risks associated with compromised devices. Additionally, Cisco has announced plans for further updates to ensure comprehensive protection, highlighting their commitment to prioritizing the security of their customers.
Unknown threat actor
The identity of the threat actor behind this extensive cyber campaign remains unknown, adding to the complexity of the situation. While the motivations and intentions of the attacker remain speculative, it is evident that thousands of Cisco devices have been affected. The extent and scale of this attack underscore the need for enhanced cybersecurity measures within the industry.
Decrease in compromised devices
Over the course of the investigation, there has been a significant decrease in the number of compromised devices. Initially, it was estimated that around 40,000 devices had fallen victim to the backdoor implant. However, recent findings suggest that the number of affected devices has reduced to just a few hundred. This decrease in compromised systems may be attributed to hidden modifications made by the attackers, concealing their presence and making them harder to detect.
Discovery of recent alterations
The cybersecurity firm, Fox-IT, has made significant strides in uncovering alterations made to the implant. These modifications have shed light on the reason behind the dramatic decline in the number of compromised devices. However, despite the decrease, it is crucial to note that over 37,000 devices still remain compromised, emphasizing the urgency of addressing the issue promptly.
Confirmation from Cisco
Cisco has officially confirmed the behavioral changes in the backdoor implant. In an effort to assist users and organizations in identifying the presence of the implant on their devices, Cisco has provided a curl command to check for its existence. This proactive approach from Cisco ensures that its customers are equipped with the necessary tools and information to safeguard their devices and networks effectively.
Reactive measures by attackers
The recent addition of a header check by the threat actors is a reactive measure to avoid the identification of compromised systems. This alteration has resulted in a sharp decline in visibility, making it increasingly challenging for security experts to detect infected systems. This evasive tactic highlights the sophistication and determination of the threat actors, necessitating a heightened level of vigilance among network administrators and IT professionals.
The discovery and subsequent modifications to the backdoor implant on Cisco devices serve as a stern reminder of the ever-evolving cyber threat landscape. The agility and adaptability of the attackers emphasize the need for continuous vigilance and robust cybersecurity practices. While Cisco’s prompt response and ongoing efforts to patch vulnerabilities are commendable, the battle to secure network infrastructures against such sophisticated threats requires a collaborative effort from all stakeholders. By prioritizing security, implementing regular updates, and remaining vigilant, organizations can effectively protect their valuable assets from the persistent and evolving cyber threats targeting Cisco devices.